New Zealand cloud provider challenges Google's claims on data control for region

A Wellington cloud services provider says Google's claim it will offer New Zealanders complete control over their own data is not true.

The US giant is setting up a cloud region in Aotearoa New Zealand, to extend its $10 billion global cloud business, as its huge rivals like Amazon build data centres here.

Catalyst Cloud questions why the government has hurried to weigh in behind the global giant when so much more could be done by locals.

Catalyst Cloud chief executive Doug Dixon was due to meet Digital Minister David Clark on 10 August to talk for the first time about domestic cloud capabilities, on the same day that Google made its announcement.

"The New Zealand cloud region will give Kiwi businesses the choice to keep their data onshore and retain data sovereignty and drive their digital transformation efforts locally," Google said.

A region is a geographic area that offers a bunch of really fast computing services, and avoids compliance hurdles of passing data between different jurisdictions.

Google quoted a couple of local firms, including Trade Me saying its cloud services had been "pivotal in ensuring the stability and resilience of our infrastructure".

Clark quickly chimed in with a statement applauding the investment: "Onshore cloud facilities give us stronger control of New Zealand's data because it is held here, where our laws and protections apply."

But Dixon pushed back.

Catalyst Cloud is at the opposite end of the size spectrum from the so-called "hyper scalers" and has only just won approval to handle government data.

"This shouldn't just be allowed to pass. It's such a huge claim. And it's really, really not true," he said.

"Overseas technology companies are governed and influenced by the laws in their home countries."

The minister in charge should be challenged too, Dixon said.

"There's a total domination being attempted here.

"Global hyper scalers should acknowledge the limits of what they can offer, and they can't offer sovereignty in anywhere other than their home country."

They should work with local cloud providers instead, he said.

Lawyers say global connectivity, which now depended on the cloud, was a big aid to business but raised problems of privacy, confidentiality and data ownership.

And being onshore is no hedge.

George Sadlier has worked for 15 years on cloud tech for Google and Microsoft, up until early this year.

"As soon as you put your data into a cloud provider ... that is based offshore, even if they store the data in New Zealand, folks offshore are going to have some level of access to it," Sadlier said.

That access was very tightly controlled, and security was very tight at the mega companies. Plus, it had yet to be really legally tested if they had to let US courts or law enforcement in to their servers, because they are US-owned, he said.

The alternative, genuine data sovereignty, came at a price.

"It involves building a self-contained environment that is operated entirely by people living in the jurisdiction," Sadlier said.

The US military poured more than $15b into its Joint Enterprise Defense Infrastructure (JEDI) system - and it failed.

It is having another go at full cloud control under the Joint Warfighter Cloud Capability initiative, with Google, Amazon, Microsoft and Oracle in the running.

Sadlier said it would depend on how New Zealanders valued their various types of data, and how much trust they had.

"You can look at the disclosures from those providers and seek guarantees from them. But ... ownership changes, policies change, companies can be acquired, they can become insolvent.

"Things change over time - data is forever."

Dixon suggested full control should extend to the likes of health data and national identity data, under a hybrid global-and-local approach.

Instead, a piecemeal government approach was undervaluing what local ingenuity could offer, he said.

"We've got this digital strategy for Aotearoa, and it talks about moving pretty much everything onto the cloud.

"And the cloud isn't owned by Kiwis. It's owned by United States corporations."

Control is one problem: Powering up the new data centres - whoever owns them - is another.

They use so much electricity that Singapore and Ireland have had or looked at moratoriums on new data centres.

Energy Minister Megan Woods said there was no specific strategy for data centres, though they fit under work on sustainable energy to ensure the electricity system could support high levels of renewables.

"I am well aware of the energy demands of data centres," she said in a statement.

"I am really excited these companies are coming here and using our renewable energy, instead of Australia's, which is coal powered."

Dixon said New Zealand should ask if it wanted its power used for processing data mostly for offshore users, and those profits returned offshore.

Sustainability Council executive director Simon Terry warned the country must get this right.

"New Zealand has to add a lot more electricity generation in the next 20 years just to displace fossil fuels, and we need to ensure all those bases are well covered before contemplating additional loads from data centres," Terry said.

In a statement to RNZ, David Clark said various foreign-owned and local cloud providers complemented each other and the government was open to working with all of them equitably and openly.

Google did not respond to a request for an interview.